A text field with maxlength, char_counter, and char_max can enter the maxlength value into the text field's value

[jonathanstegall]

Describe the bug

This is very sporadic and I'm not sure how to consistently reproduce it yet, but I've seen this happen a few times. The situation is that when I create a field that has these three attributes: char_counter => true, char_max => 78, and attributes'['maxlength'] => 78, the value of "78" sometimes appears and gets saved as the value for the text field. It can be cleared out manually, but it's often not clear that it has happened since it's inside a box that is closed by default.

Steps to reproduce:

In a theme's functions.php (in my case it's in an included file), create a box and text field with these settings (I've added the code below). Like I mentioned, this doesn't happen on every post save and I haven't been able to consistently reproduce it, so I'm not sure yet what causes it.

Possible Solution

I notice that my field doesn't have a default attribute. I'm going to try giving it a default => '' and see if that helps, but it may take a bit before I can tell for sure. In any case, it seems odd that it would do this with or without a default attribute.

Possible Solution's Risk Level

It could a relatively high risk, depending on what the field is and how important it is, but because it's so rare I have difficulty saying that it's high risk.

Screenshots

CMB2 Field Registration Code:

$object_type  = 'post';
$seo_settings = new_cmb2_box(
    array(
        'id'           => 'seo_settings',
        'title'        => 'SEO & Social Settings',
        'object_types' => array( $object_type ),
        'context'      => 'normal',
        'priority'     => 'high',
        'closed'       => true,
    )
);
$seo_settings->add_field(
    array(
        'name'         => 'Title',
        'id'           => '_mp_seo_title',
        'type'         => 'text',
        'char_counter' => true,
        'char_max'     => 78,
        'desc'         => sprintf(
            // translators: 1) the sitename
            esc_html__( 'If you do not fill this out, the post title will be used. If you do fill it out and do not include %1$s in the value, it will be placed at the end in this way: Your Title | %1$s' ),
            get_bloginfo( 'name' )
        ),
        'attributes'   => array(
            'maxlength' => 78,
        ),
    )
);

Your Environment

Browser name and version:
I've seen this happen in Firefox and Chrome, but again it is very rare.

[tw2113]

Apparently char_counter and char_max are new arguments that I'm not super familiar with yet.

Edit: 2 years ago no less.